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OVERVIEW OF THE BASELINE CONFIGURATION 

Failure detection and identification logic for a fault- tolerant longitudinal 
control system were investigated. Aircraft dynamics were based upon the cruise 
condition for a hypothetical transonic business jet transport configuration. The 
fault- tolerant control system consists of conventional control and estimation plus 
a new "outer loop" containing failure detection, identification, and reconfigura- 
tion (FDIR) logic. It is assumed that the additional logic has access to all 
measurements, as well as to the outputs of the control and estimation logic. The 
pilot also may command the FDIR logic to perform special tests. 


• PARALLEL AND ANALYTICAL REDUNDANCY 

• DETECTION AND IDENTIFICATION OF FAILURES IN: 

- STATE SENSORS 

- CONTROL EFFECTORS 

- CONTROL-EFFECTOR SENSORS 

- AIRFRAME CHARACTERISTICS 

• TRANSONIC BUSINESS JET EXAMPLE 


OVERVIEW OF THE BASELINE CONFIGURATION 
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SIMULATION STRUCTURE 



V 4 


Simulation of the fault- tolerant control system was conducted using a general- 
purpose computer and the FORTRAN programming language. The simulation accounts for 
parallel redundancy in control system elements as well as analytical redundancy. 

The latter uses the mathematical relationships between dissimilar sensors to iden- 
tify failures when it is suspected that one of two similar sensors has failed. It 
uses these same relationships to detect as well as identify failures when there is 
just one sensor of a kind. The logic distinguishes between failures of control 
effectors and failures of the sensors that measure control effector position. It 
also detects changes in aircraft dynamics, as might result from structural damage. 



58 













SINGLE- SENSOR FDI TREE 

When there is no hardware redundancy remaining, failure detection and 
identification follows a tree structure, beginning with the simplest mathematical 
relationships between dissimilar sensors. For the most part, algebraic equations 
are used; however, it is necessary to use a Kalman filter to distinguish between 
angle-of-attack, manual-acceleration, and altitude sensor errors. 






SINGLE-SENSOR STEP- AND RAMP-FAILURE 


DETECTION TIMES 

The threshold for failure detection was set just above the estimated 2.5-a 
level. Step and ramp failures were simulated, with the results shown on the figure. 
The procedure generally was successful in detecting 5-0 step failures. It also 
could detect moderately steep (L/4) ramp- type failures; as the slope of the ramp 
decreased, detection times increased. 
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EFFECTOR AND EFFECTOR- SENSOR 


FAILURE DETECTION TIMES 

Similar tests were made with errors in the control effectors and their sensors. 
These failures were detected quickly with 4-0 steps, and it was possible to dis- 
tinguish readily between failures in the effectors and their associated sensors. 

Additional results and conclusions are contained in the thesis by F. Dallery, 
"Failure Detection and Identification for a Reconf igurable Flight Control System," 
Princeton University Report No. MAE-1639T, Nov. 1983. 


EFFECTOR FAILURES 
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